The recent ruling by the Personal Data Protection Commission (PDPC) in the case of Abdul Said Naumanga v. Mi Casa Company Limited marks a significant milestone in Tanzania’s data privacy landscape. This is one of the first known instances where the Commission has awarded monetary compensation for a data protection violation, sending a clear message to individuals and organizations alike about the serious nature of personal data privacy. The decision, which included a Tanzania Shillinga Twenty Million (TZS 20,000,000/=) award and an order for the deletion of personal data, underscores the Commission’s commitment to enforcing the Personal Data Protection Act (PDPA), Cap 44. This case serves as a crucial precedent, highlighting the importance of obtaining consent and the severe consequences of continued privacy breaches. It is a powerful reminder that all entities operating in Tanzania must now prioritize data protection compliance.
Case Review and Appraisal: Abdul Said Naumanga v. Mi Casa Company Limited
This case concerns a complaint filed by Abdul Said Naumanga (the Complainant) against Mi Casa Company Limited (the Respondent) with the Personal Data Protection Commission (PDPC). The Complainant sought several reliefs, including the deletion of posts, monetary compensation of TZS 400,000,000, and any other relief the Commission deemed appropriate. The hearing was conducted ex-parte because the Respondent failed to submit a reply.
Facts of the Case
- In May 2024, the Complainant’s mother, Catherine Tesha, informed him that she had seen pictures and videos of him online.
- The Complainant discovered these photos and videos, which were posted between February and April 2023, on the Respondent’s Instagram account.
- He requested that the company delete the concerned posts, and the company promised to do so but did not.
- In August 2024, the Complainant, who had been employed by Msando Law Office since July 2024, was suspended from work on the grounds of embarrassing the office due to the posted pictures and videos.
- He successfully defended himself by proving the photos were taken before his employment, and he was reinstated on September 2, 2024.
Issues for Determination
The Commission framed three issues for determination:
- Whether Mi Casa Company Limited used the Complainant’s personal information without his consent.
- Whether the alleged violation occurred while the Personal Data Protection Act (PDPA) was in force.
- Whether the PDPC had the authority to hear and determine the matter.
Commission’s Findings and Rationale
- Issue 1: Unauthorized Use of Personal Information: The Commission found that the Respondent used the Complainant’s identifiable photos and videos without his consent. A photograph is defined as a “mark or other special form that identifies a person” under the Personal Data Protection Act, Cap 44. The Commission determined that using these without consent is a violation of the PDPA.
- Issues 2 & 3: Retroactive Application of the Law: The material was posted between February and April 2023 , but the Personal Data Protection Act, Cap 44, came into force on May 1, 2023. The Commission acknowledged that Article 13(6)(c) of the Constitution of the United Republic of Tanzania prohibits punishing a person for an act that was not an offense at the time it was committed. However, the Commission applied the principle of “continued breach” because the photos and videos were still present on the Respondent’s Instagram account at the time of the complaint, causing ongoing harm to the Complainant. This principle allowed the Commission to entertain the complaint, even though the initial act occurred before the law’s enactment. The continued presence of the content was considered an inappropriate violation of basic privacy norms and an unauthorized use of personal data.
Commission’s Orders
Based on its findings and in the interest of protecting privacy and preventing further harm, the Commission issued the following orders:
- Mi Casa Company Limited must pay the Complainant a monetary compensation of TZS 20,000,000 for general damages.
- Mi Casa Company Limited must immediately delete all photos and videos of the Complainant from its Instagram account and any other media platforms where they are accessible.
Importance of Registration with the PDPC and Adhering to the PDPA
This case highlights the critical importance for all organizations to register with the Personal Data Protection Commission and to strictly adhere to the principles of the Personal Data Protection Act (PDPA), Cap 44. The law is in effect as of May 1, 2023.
Organizations that handle personal data, such as photos and videos of individuals, must be aware of their legal obligations. Failure to comply can result in serious consequences, as seen in this case. The ruling demonstrates that organizations can be held liable for unauthorized use of personal data, even if the initial act occurred before the law’s enactment, provided the breach is ongoing.
Key takeaways from this ruling emphasize the following:
- Consent is Mandatory: Using an individual’s personal data, including photos and videos, requires their explicit consent. Unauthorized use is a violation of the PDPA.
- Accountability for Continued Breach: Organizations must be proactive in managing data, particularly content on social media. The “continued presence” of unauthorized personal data can be considered a violation, even if the initial posting predates the law. This means organizations have a responsibility to audit and remove any non-compliant data they may hold.
- Financial and Reputational Consequences: The TZS 20,000,000 fine imposed on Mi Casa Company Limited serves as a clear warning that non-compliance with the PDPA can lead to significant financial penalties. Furthermore, being a party in such a case can damage a company’s reputation and customer trust.
Registration with the PDPC and adherence to the PDPA are not merely bureaucratic requirements; they are fundamental to respecting individual privacy and avoiding legal and financial repercussions. This ruling reinforces that the protection of personal data is a priority and that the PDPC will take action against violations to prevent further harmagainst violations to prevent further harm.
Our team at RIVE &CO is available to provide further clarification and assist with any queries you may have regarding the case. Please do not hesitate to contact our Partner Sunday Ndamugoba for support via sunday@rive.co.tz or ask@rive.co.tz